From 0f2caf1cb6711c38055edbc0b41484a1853ebead Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=96=AF=E7=8B=82=E7=9A=84=E7=8B=AE=E5=AD=90li?= <15040126243@163.com> Date: Sun, 26 Sep 2021 14:08:28 +0800 Subject: [PATCH 1/2] =?UTF-8?q?update=20security=20=E8=B7=AF=E5=BE=84?= =?UTF-8?q?=E9=85=8D=E7=BD=AE=E6=8A=BD=E5=8F=96=E5=88=B0=E9=85=8D=E7=BD=AE?= =?UTF-8?q?=E6=96=87=E4=BB=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ruoyi-admin/src/main/resources/application.yml | 17 +++++++++++++++++ .../ruoyi/framework/config/SecurityConfig.java | 15 +++++---------- 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/ruoyi-admin/src/main/resources/application.yml b/ruoyi-admin/src/main/resources/application.yml index fa95235a7..9f649edb0 100644 --- a/ruoyi-admin/src/main/resources/application.yml +++ b/ruoyi-admin/src/main/resources/application.yml @@ -106,6 +106,23 @@ token: # 令牌有效期（默认30分钟） expireTime: 30 +# security配置 +security: + anonymous: + - /login + - /register + - /captchaImage + # swagger 文档配置 + - /doc.html + - /swagger-resources/** + - /webjars/** + - /*/api-docs + # druid 监控配置 + - /druid/** + # actuator 监控配置 + - /actuator + - /actuator/** + # 重复提交 repeat-submit: # 全局间隔时间(毫秒) diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java index bd6ee8f36..855be657c 100644 --- a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java +++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java @@ -1,5 +1,6 @@ package com.ruoyi.framework.config; +import com.ruoyi.framework.config.properties.SecurityProperties; import com.ruoyi.framework.security.filter.JwtAuthenticationTokenFilter; import com.ruoyi.framework.security.handle.AuthenticationEntryPointImpl; import com.ruoyi.framework.security.handle.LogoutSuccessHandlerImpl; @@ -56,6 +57,9 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter @Autowired private CorsFilter corsFilter; + @Autowired + private SecurityProperties securityProperties; + /** * 解决 无法直接注入 AuthenticationManager * @@ -96,8 +100,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() // 过滤请求 .authorizeRequests() - // 对于登录login 注册register 验证码captchaImage 允许匿名访问 - .antMatchers("/login", "/register", "/captchaImage").anonymous() .antMatchers( HttpMethod.GET, "/", @@ -106,14 +108,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter "/**/*.css", "/**/*.js" ).permitAll() - .antMatchers("/doc.html").anonymous() - .antMatchers("/swagger-resources/**").anonymous() - .antMatchers("/webjars/**").anonymous() - .antMatchers("/*/api-docs").anonymous() - .antMatchers("/druid/**").anonymous() - // Spring Boot Actuator 的安全配置 - .antMatchers("/actuator").anonymous() - .antMatchers("/actuator/**").anonymous() + .antMatchers(securityProperties.getAnonymous()).anonymous() // 除上面外的所有请求全部需要鉴权认证 .anyRequest().authenticated() .and() From 92804151a3459162438be2e66e589fd33a3c8087 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=96=AF=E7=8B=82=E7=9A=84=E7=8B=AE=E5=AD=90li?= <15040126243@163.com> Date: Sun, 26 Sep 2021 14:08:48 +0800 Subject: [PATCH 2/2] =?UTF-8?q?update=20=E4=BC=98=E5=8C=96=E5=8C=BF?= =?UTF-8?q?=E5=90=8D=E8=B7=AF=E5=BE=84jwt=E6=94=BE=E8=A1=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../config/properties/SecurityProperties.java | 22 +++++++++++++++++++ .../filter/JwtAuthenticationTokenFilter.java | 13 +++++++++++ 2 files changed, 35 insertions(+) create mode 100644 ruoyi-framework/src/main/java/com/ruoyi/framework/config/properties/SecurityProperties.java diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/properties/SecurityProperties.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/properties/SecurityProperties.java new file mode 100644 index 000000000..33414cedb --- /dev/null +++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/properties/SecurityProperties.java @@ -0,0 +1,22 @@ +package com.ruoyi.framework.config.properties; + +import lombok.Data; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.stereotype.Component; + +/** + * Security 配置属性 + * + * @author Lion Li + */ +@Data +@Component +@ConfigurationProperties(prefix = "security") +public class SecurityProperties { + + /** + * 匿名放行路径 + */ + private String[] anonymous; + +} diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/security/filter/JwtAuthenticationTokenFilter.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/security/filter/JwtAuthenticationTokenFilter.java index 5439a979b..2c5e3029e 100644 --- a/ruoyi-framework/src/main/java/com/ruoyi/framework/security/filter/JwtAuthenticationTokenFilter.java +++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/security/filter/JwtAuthenticationTokenFilter.java @@ -4,11 +4,14 @@ import com.ruoyi.common.core.domain.model.LoginUser; import com.ruoyi.common.core.service.TokenService; import com.ruoyi.common.utils.SecurityUtils; import com.ruoyi.common.utils.StringUtils; +import com.ruoyi.framework.config.properties.SecurityProperties; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.authentication.WebAuthenticationDetailsSource; import org.springframework.stereotype.Component; +import org.springframework.util.AntPathMatcher; +import org.springframework.util.PathMatcher; import org.springframework.web.filter.OncePerRequestFilter; import javax.servlet.FilterChain; @@ -28,10 +31,20 @@ public class JwtAuthenticationTokenFilter extends OncePerRequestFilter @Autowired private TokenService tokenService; + @Autowired + private SecurityProperties securityProperties; + @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { + // 匿名路径放行 + for (String anonymou : securityProperties.getAnonymous()) { + PathMatcher pm = new AntPathMatcher(); + if (pm.matchStart(anonymou, request.getRequestURI())) { + chain.doFilter(request, response); + } + } LoginUser loginUser = tokenService.getLoginUser(request); if (StringUtils.isNotNull(loginUser) && StringUtils.isNull(SecurityUtils.getAuthentication())) {